paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 48 Packages Projects Releases Wiki Activity

docs: clarify Auth0 logout changeset description

Browse Source 
The original changeset implied the logout redirect only happens when
federatedLogout is true. In reality, sign-out always redirects to
Auth0's /v2/logout to clear the Auth0 session cookie. The
federatedLogout flag only controls whether the upstream IdP session
is also terminated.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Jonathan Roebuck <jroebuck@spotify.com>
This commit is contained in:
Jonathan Roebuck
2026-04-13 16:25:09 +01:00
parent 722b35e1a4
commit 0e31e9c312
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/auth0-federated-logout.md
+3 -1
View File
@@ -2,4 +2,6 @@
'@backstage/plugin-auth-backend-module-auth0-provider': minor
---
Added federated logout support. Set `federatedLogout: true` in the Auth0 provider config to clear both the Auth0 session and any upstream IdP session on sign-out. The authenticator returns a logout URL that redirects the browser to Auth0's `/v2/logout?federated` endpoint, ensuring users must fully re-authenticate after signing out.
Sign-out now redirects the browser to Auth0's `/v2/logout` endpoint, clearing the Auth0 session cookie so that users must re-authenticate on next sign-in. Previously, only the Backstage session was cleared, allowing users to sign back in without re-entering credentials.
Set `federatedLogout: true` in the Auth0 provider config to additionally clear the upstream IdP session (e.g. Okta, Google), requiring full re-authentication across the entire SSO chain.